Packages / sqlite3 / Security

HighVulnerabilityGHSA-9qrh-qjmc-5w2pCVE-2022-21227Published 28 Apr 2022

Denial-of-Service when binding invalid parameters in sqlite3

Affected releases · sqlite3

  • 5.x5.0.0 – 5.0.2Fixed in 5.0.3

On 5.x, the newest line:

npm install sqlite3@5.0.3
6.x

  1. Not affected

    6.0.1

    1 release, latest

5.x

  1. Affected

    5.0.0 – 5.0.2

    3 releases

  2. Fixed

    5.0.3 – 5.1.7

    17 releases

104 stable releases of sqlite3, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for sqlite3. It is read in your browser and sent nowhere.

What happens

Affected versions of sqlite3 will experience a fatal error when supplying a specific object in the parameter array. This error causes the application to crash and could not be caught. Users of sqlite3 v5.0.0, v5.0.1 and v5.0.2 are affected by this. This issue is fixed in v5.0.3. All users are recommended to upgrade to v5.0.3 or later. Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters as a workaround.